An authentication bypass vulnerability in the-momentum open-wearables allows unauthenticated remote attackers to redeem invitation codes, potentially compromising user registration workflows.

This is a missing authentication vulnerability (CWE-306) located in the redeem_invitation_code function within the backend/app/api/routes/v1/user_invitation_code.py file. The endpoint fails to perform necessary authentication checks, allowing remote attackers to manipulate the code argument to perform unauthorized actions.

The ability to bypass authentication for invitation code redemption can lead to unauthorized account creation or abuse of business logic within the open-wearables platform. With a CVSS score of 7.3, this vulnerability poses a risk to system integrity and could be leveraged to gain unauthorized access or manipulate user-related data.

Immediate Action: Update the open-wearables deployment to a version beyond 0.6.2 once the vendor provides a fix, or apply the specific security patches referenced in the GitHub issue tracker.

Proactive Monitoring: Review application access logs for abnormal volumes of invitation code redemption requests originating from single or suspicious IP addresses.

Compensating Controls: Implement rate limiting on the invitation code redemption endpoint to mitigate the impact of automated exploitation attempts.

Public Exploit Available: No confirmed public exploit is available in the provided data.

Security teams should track the official the-momentum GitHub repository for a fix and prioritize updating the affected components. Until a patch is applied, ensure that monitoring is in place to detect anomalous activity related to the invitation system.